Member Avatar for BTW8892

Hello,

I am currently trying to develope a perl CGI script that will allow a user to enter a name on an HTML form, and it will search the database with that name. Once it finds the matched names, it will display their name and telephone number on the screen. I'm not completely sure how to go about this, so I was wondering if anyone could share any sort of insight.

Thank you very much in advance.

HTML FORM

<HTML>
<HEAD><TITLE>Search Telephone Number</TITLE></HEAD>
<BODY BGCOLOR=#FFFFCC>
<H3>Search A Telephone Number</H3>
<FORM ACTION="project2_searchnum.pl" METHOD=POST>
<TABLE>
<TR>
    <TD>Name:</TD>
    <TD><INPUT NAME=fullname SIZE="20"></TD>
</TR>
</TABLE>
<P><INPUT TYPE=submit VALUE="Submit"> <INPUT TYPE=reset> <INPUT TYPE="button" VALUE="Go Back" onClick="history.go(-1);return true;"></P>
</FORM>

</BODY>
</HTML>

PERL SCRIPT

#!/usr/bin/perl

#use warnings;
#use strict;

use DBI;
use DBD::mysql;
use CGI qw( :standard );

my $cgi = new CGI;

print "Content-type: text/html\n\n";

#connecting to the database 
my $dbh = DBI->connect( 
"DBI:mysql:****", "******", "******" ) or
   die( "Could not make connection to database: $DBI::errstr" );

#setting params from the html form
$q=new CGI;
$name=$q->param('fullname');
$number=$q->param('number');



#Webpage creation
print "<HTML>\n";
print "<HEAD><TITLE>Project 1 - Search a Telephone Number</TITLE><BASEFONT SIZE=5></HEAD>\n";
print "<H1>Search a Telephone Number</H1>\n";
print "<BODY BGCOLOR=#FFFFCC>\n";

#Display names and numbers from search here

print "<a href='project2_main.html'><INPUT TYPE='button' VALUE='Main Menu'</a>\n";

print "</BODY>\n";
print "</HTML>\n";

$sth->finish();
$dbh->disconnect();
  • 2 Contributors
  • 1 Reply
  • 205 Views
  • 3 Weeks Discussion Span
  • Latest Post Latest Post by kordaff

Dani AI

Generated

Quick diagnosis and what’s actually causing the errors: ’s form posts a field named fullname but the script also reads a number param that isn’t in the form; the script never prepares or executes a statement before calling $sth->finish; two CGI objects are created ($cgi and $q); and use strict / use warnings are commented out. The “Main Menu” line also mixes an anchor and an input in a way that is malformed. Those issues will either prevent the script from running or hide bugs.

Minimal corrections to apply first: enable use strict; use warnings;, declare variables with my, use a single CGI->new object, print a proper header (include charset), and connect with DBI using sensible options (for example, RaiseError => 1). Keep credentials out of repository and test the DSN/credentials separately.

Safe query and output pattern (conceptual example): prepare a statement with a placeholder, bind user input (or use LIKE + wildcards for partial matches), iterate with fetchrow_hashref, and HTML-escape any values before printing to avoid XSS. Also trim and validate the incoming fullname (limit length, remove control chars) before using it in the query.

Troubleshooting and best practices: check the webserver error log for runtime messages; run perl -c to catch syntax problems; handle the “no results” case with a friendly message; call $sth->finish and $dbh->disconnect only after use; prefer placeholders to avoid SQL injection; consider DBIx::Class or a template system for larger projects; and, as recommended, prepare and execute a DB statement — the approach above shows a safer, production-oriented variant.

Member Avatar for kordaff

If you've named your table phonelist and your columns name and number, insert this at line 23:

my $sth = $dbh->prepare("SELECT name,number from phonelist where name=?");
$sth->execute($name);
my @row;

At line 33, insert this:

while (@row = $sth->fetchrow_array)
  {print "Found:  Name=$row[0] Phone Number=$row[1]<br>\n";
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.